Skip to content

Commit f8d3c5e

Browse files
committed
[RTTI] Fix vtables straddling section boundaries causing a OOB exception
This fixes an issue with certain shared cache binaries where a VFT was placed at the tail of the const data section
1 parent 5c2f42a commit f8d3c5e

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

plugins/rtti/itanium.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,9 @@ std::optional<VirtualFunctionTableInfo> ItaniumRTTIProcessor::ProcessVFT(uint64_
561561
std::vector<VirtualFunctionInfo> virtualFunctions = {};
562562
while (true)
563563
{
564+
uint64_t readOffset = reader.GetOffset();
565+
if (!m_view->IsValidOffset(readOffset))
566+
break;
564567
uint64_t vFuncAddr = reader.ReadPointer();
565568
auto funcs = m_view->GetAnalysisFunctionsForAddress(vFuncAddr);
566569
if (funcs.empty())

plugins/rtti/microsoft.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -487,6 +487,9 @@ std::optional<VirtualFunctionTableInfo> MicrosoftRTTIProcessor::ProcessVFT(uint6
487487
std::vector<std::pair<uint64_t, std::optional<Ref<Function>>>> virtualFunctions = {};
488488
while (true)
489489
{
490+
uint64_t readOffset = reader.GetOffset();
491+
if (!m_view->IsValidOffset(readOffset))
492+
break;
490493
uint64_t vFuncAddr = reader.ReadPointer();
491494
auto funcs = m_view->GetAnalysisFunctionsForAddress(vFuncAddr);
492495
if (funcs.empty())

0 commit comments

Comments
 (0)